Bug 858406

Created attachment 614140 [details]
Sample module outlining all the permissions required for PITR implementation with SSH and RSync

Description of problem:

Currently RHEL-shipped SELinux policy is not set up to work with PostgreSQL's PITR (point-in-time recovery). In order to apply most common methods for PITR implementation one needs to manually generate corresponding module. From information I've gathered implementation ends up being fairly similar in each case thus may warrant a tunable implemented in default policies to allow PostgreSQL to transfer WAL files to the secondary node[s]. 

In my particular case I'm implementing PGPool-II replication with PITR. (Following documentation at: http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery ). 

Version-Release number of selected component (if applicable):

selinux-policy-targeted-3.7.19-155.el6_3.noarch
selinux-policy-3.7.19-155.el6_3.noarch

How reproducible:

Always.

Steps to Reproduce:
1. setup PGPool-II and PITR recovery as per http://www.pgpool.net/docs/latest/pgpool-en.html#online-recovery
1a. namely add to /var/lib/pgsql/data/postgresql.conf:

archive_mode = on 
archive_command = '/usr/bin/rsync %p postgres.3.4:/var/spool/pgsql/wal/%f < /dev/null'

which essentially asks postgres to send WAL files over to the secondary machine whenever it reaches checkpoint.

2. launch "psql -U postgres template1" on one of the nodes
3. => select pg_backup_start("backup_test");
4. => select pg_backup_stop()
  
Actual results:

WARNING:  pg_stop_backup still waiting for archive to complete (60 seconds elapsed)

and a lot of SELinux denials

Expected results:

operation to succeed.

Additional info:

PGPool-II used is built using SPEC file in bug #847357 which essentially is a Fedora package rebuilt and tweaked to work in RHEL